KVM & QEMU on Ubuntu Desktop: Comprehensive Tutorial #

# Check for vmx (Intel) or svm (AMD) flags
grep -Eoc '(vmx|svm)' /proc/cpuinfo
# Non-zero output = virtualization is supported

# More detailed check
egrep -c '(vmx|svm)' /proc/cpuinfo
# Shows number of CPU threads with support

lsmod | grep kvm
# Expected output:
# kvm_intel   (or kvm_amd)
# kvm

# Load manually if not present
sudo modprobe kvm
sudo modprobe kvm_intel   # or kvm_amd

# Check if IOMMU is enabled
dmesg | grep -e DMAR -e IOMMU
# Look for "DMAR: IOMMU enabled" or "AMD-Vi: AMD IOMMUv2 loaded"

# Check IOMMU groups
find /sys/kernel/iommu_groups/ -type l | sort -V

# Intel
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash intel_iommu=on iommu=pt"

# AMD
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash amd_iommu=on iommu=pt"

sudo update-grub
sudo reboot

sudo apt update
sudo apt install -y \
    qemu-system-x86 \
    qemu-utils \
    libvirt-daemon-system \
    libvirt-clients \
    bridge-utils \
    virt-manager \
    ovmf \
    virtinst \
    libguestfs-tools \
    cloud-image-utils

sudo systemctl enable --now libvirtd
sudo systemctl status libvirtd

virsh version --daemon
# Should show libvirt version and QEMU version

kvm-ok
# "KVM acceleration can be used" = you're good
# If kvm-ok isn't found: sudo apt install cpu-checker

sudo usermod -aG libvirt $USER
sudo usermod -aG kvm $USER

# Apply without logging out (for current session)
newgrp libvirt

groups $USER
# Should show: ... libvirt kvm ...

# System connection (manages system-wide VMs, requires group membership)
virsh -c qemu:///system list --all

# Session connection (user-space VMs, no root required, more limited)
virsh -c qemu:///session list --all

uri_default = "qemu:///system"

# Check default network
virsh net-list --all

# Start default network if not active
virsh net-start default
virsh net-autostart default

# Inspect network details
virsh net-dumpxml default

ip link show
# Note your NIC name: e.g., enp3s0, eth0, eno1

network:
  version: 2
  renderer: networkd
  ethernets:
    enp3s0:
      dhcp4: no
  bridges:
    br0:
      interfaces: [enp3s0]
      dhcp4: yes
      parameters:
        stp: false
        forward-delay: 0

sudo netplan apply
ip addr show br0

<network>
  <name>bridge-net</name>
  <forward mode="bridge"/>
  <bridge name="br0"/>
</network>

virsh net-define bridge-network.xml
virsh net-start bridge-net
virsh net-autostart bridge-net

<network>
  <name>isolated</name>
  <bridge name="virbr1" stp="on" delay="0"/>
  <ip address="10.10.10.1" netmask="255.255.255.0">
    <dhcp>
      <range start="10.10.10.2" end="10.10.10.254"/>
    </dhcp>
  </ip>
</network>

virsh net-define isolated.xml
virsh net-start isolated
virsh net-autostart isolated

# Get VM's MAC address
virsh dumpxml myvm | grep 'mac address'

# Add static lease
virsh net-update default add ip-dhcp-host \
  "<host mac='52:54:00:XX:XX:XX' name='myvm' ip='192.168.122.50'/>" \
  --live --config

virsh pool-list --all
virsh pool-info default

# Directory-based pool
virsh pool-define-as mypool dir --target /data/vms
virsh pool-build mypool
virsh pool-start mypool
virsh pool-autostart mypool

# Create a 50GB qcow2 image (thin-provisioned)
qemu-img create -f qcow2 /var/lib/libvirt/images/myvm.qcow2 50G

# Create a raw image (pre-allocated)
qemu-img create -f raw /var/lib/libvirt/images/myvm.raw 50G

# Convert between formats
qemu-img convert -f raw -O qcow2 input.raw output.qcow2
qemu-img convert -f qcow2 -O raw input.qcow2 output.raw

# Inspect an image
qemu-img info myvm.qcow2

# Resize an image (grow only; shrinking is risky)
qemu-img resize myvm.qcow2 +20G

# Check image integrity
qemu-img check myvm.qcow2

# Create a VG for VMs (replace /dev/sdb with your device)
sudo pvcreate /dev/sdb
sudo vgcreate vms-vg /dev/sdb

# Define LVM pool in libvirt
virsh pool-define-as lvm-pool logical \
  --source-name vms-vg \
  --target /dev/vms-vg
virsh pool-start lvm-pool
virsh pool-autostart lvm-pool

# Create an LV for a VM
virsh vol-create-as lvm-pool myvm-disk 50G

virt-manager

# Connect via serial console (if configured in guest)
virsh console myvm

# Disconnect from serial console
Ctrl + ]

# List VMs
virsh list           # running only
virsh list --all     # all VMs including stopped

# Start / Stop / Reboot
virsh start myvm
virsh shutdown myvm      # graceful (ACPI)
virsh destroy myvm       # forced off (like power cut)
virsh reboot myvm
virsh reset myvm         # hard reset

# Suspend / Resume
virsh suspend myvm
virsh resume myvm

# Delete a VM (removes definition; does NOT delete disk images)
virsh undefine myvm

# Delete VM and its storage volumes
virsh undefine --nvram myvm --remove-all-storage

virsh autostart myvm           # enable autostart on host boot
virsh autostart --disable myvm # disable

# Dump full XML config
virsh dumpxml myvm

# Edit VM XML config (opens in $EDITOR)
virsh edit myvm

# Set vCPUs (while VM is stopped)
virsh setvcpus myvm 4 --config --maximum
virsh setvcpus myvm 4 --config

# Set RAM (in kibibytes)
virsh setmaxmem myvm 8388608 --config   # 8GB max
virsh setmem myvm 8388608 --config      # 8GB current

# Attach a disk image to running VM
virsh attach-disk myvm /var/lib/libvirt/images/extra.qcow2 vdb \
  --driver qemu --subdriver qcow2 --live --config

# Detach disk
virsh detach-disk myvm vdb --live --config

# Attach a USB device (by vendor:product)
virsh attach-device myvm usb-device.xml --live

# Eject/change CD-ROM
virsh change-media myvm sda /path/to/new.iso --live
virsh change-media myvm sda --eject --live

# CPU/memory stats
virsh domstats myvm
virsh cpu-stats myvm

# Disk I/O stats
virsh domblkstat myvm vda

# Network stats
virsh domifstat myvm vnet0

# Top-like view across all VMs
virt-top

# Create snapshot
virsh snapshot-create-as myvm snap1 "Before update" --disk-only --atomic

# List snapshots
virsh snapshot-list myvm

# Revert to snapshot
virsh snapshot-revert myvm snap1

# Delete snapshot
virsh snapshot-delete myvm snap1

virt-install \
  --name ubuntu-server \
  --ram 4096 \
  --vcpus 2 \
  --disk path=/var/lib/libvirt/images/ubuntu-server.qcow2,size=40,format=qcow2,bus=virtio \
  --cdrom /home/user/iso/ubuntu-22.04-server.iso \
  --os-variant ubuntu22.04 \
  --network network=default,model=virtio \
  --graphics spice \
  --video qxl \
  --boot uefi \
  --noautoconsole

virt-install \
  --name myvm \
  --ram 2048 \
  --vcpus 2 \
  --disk path=/var/lib/libvirt/images/existing.qcow2,format=qcow2,bus=virtio \
  --import \
  --os-variant linux2022 \
  --network network=default,model=virtio \
  --noautoconsole

osinfo-query os | grep -i ubuntu
osinfo-query os | grep -i rhel

--cpu host-passthrough       # Pass host CPU features to guest
--hugepages                  # Use hugepages for memory
--memorybacking hugepages=on
--numatune 0                 # Pin to NUMA node 0
--disk cache=none            # Safest for data integrity
--disk cache=writeback       # Better performance (with UPS)
--network bridge=br0         # Use bridged network
--console pty,target_type=serial  # Enable serial console
--extra-args 'console=ttyS0,115200'  # Kernel args for serial

qemu-system-x86_64 \
  -name "test-vm" \
  -machine type=q35,accel=kvm \
  -cpu host \
  -m 2048 \
  -smp 2 \
  -drive file=/var/lib/libvirt/images/test.qcow2,format=qcow2,if=virtio \
  -cdrom /path/to/install.iso \
  -boot order=dc \
  -netdev user,id=net0 \
  -device virtio-net-pci,netdev=net0 \
  -display sdl \
  -vga virtio

qemu-system-x86_64 \
  -name "headless-vm" \
  -machine type=q35,accel=kvm \
  -cpu host \
  -m 4096 \
  -smp 4 \
  -drive file=/var/lib/libvirt/images/vm.qcow2,format=qcow2,if=virtio,cache=none \
  -netdev bridge,id=net0,br=virbr0 \
  -device virtio-net-pci,netdev=net0 \
  -display vnc=:0 \
  -daemonize \
  -pidfile /tmp/myvm.pid

qemu-system-x86_64 \
  -machine type=q35,accel=kvm \
  -cpu host \
  -m 2048 \
  -drive if=pflash,format=raw,unit=0,readonly=on,file=/usr/share/OVMF/OVMF_CODE.fd \
  -drive if=pflash,format=raw,unit=1,file=/tmp/OVMF_VARS.fd \
  -drive file=vm.qcow2,format=qcow2,if=virtio \
  ...

# Launch with monitor socket
-monitor unix:/tmp/qemu-monitor.sock,server,nowait

# Connect to monitor
socat - UNIX-CONNECT:/tmp/qemu-monitor.sock

# Monitor commands
(qemu) info status
(qemu) info block
(qemu) savevm snap1
(qemu) loadvm snap1
(qemu) system_powerdown
(qemu) quit

# Via virsh (recommended)
virsh snapshot-create-as myvm \
  --name "pre-upgrade" \
  --description "Before OS upgrade" \
  --atomic

# Revert
virsh snapshot-revert myvm pre-upgrade

# List
virsh snapshot-list myvm --tree

# Delete
virsh snapshot-delete myvm pre-upgrade

virsh snapshot-create-as myvm snap1 \
  --disk-only \
  --diskspec vda,snapshot=external,file=/var/lib/libvirt/images/myvm-snap1.qcow2 \
  --atomic

# Commit changes back to base image and pivot back to base
virsh blockcommit myvm vda --active --verbose --pivot

# Clone a shut-down VM
virt-clone \
  --original myvm \
  --name myvm-clone \
  --auto-clone

# Clone with specific disk path
virt-clone \
  --original myvm \
  --name myvm-clone \
  --file /var/lib/libvirt/images/myvm-clone.qcow2

# Create a full copy
qemu-img convert -f qcow2 -O qcow2 source.qcow2 dest.qcow2

# Create a linked clone (thin, uses source as backing)
qemu-img create -f qcow2 -b source.qcow2 -F qcow2 linked-clone.qcow2

# Use host-passthrough for best performance
# In virt-manager: CPU > Copy host CPU configuration
# Or in XML:
<cpu mode='host-passthrough' check='none'>
  <topology sockets='1' cores='4' threads='2'/>
</cpu>

<vcpupin vcpu='0' cpuset='2'/>
<vcpupin vcpu='1' cpuset='3'/>
<vcpupin vcpu='2' cpuset='6'/>
<vcpupin vcpu='3' cpuset='7'/>
<emulatorpin cpuset='0-1'/>

numactl -H
lstopo

# Check available hugepages
cat /proc/meminfo | grep Huge

# Allocate hugepages at runtime (not persistent)
echo 2048 | sudo tee /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages

# Persistent allocation via /etc/sysctl.conf
vm.nr_hugepages = 2048

# Mount hugetlbfs if not already
sudo mount -t hugetlbfs -o pagesize=2M none /dev/hugepages

<memoryBacking>
  <hugepages>
    <page size='2048' unit='KiB'/>
  </hugepages>
  <nosharepages/>
  <locked/>
</memoryBacking>

# cache=none: safest, bypasses host cache (good for databases)
# cache=writeback: faster, uses host cache
# cache=unsafe: fastest, ignore fsync (never for production)

# io=native: use Linux AIO (requires cache=none)
# io=threads: thread-based async I/O

<disk type='file' device='disk'>
  <driver name='qemu' type='qcow2' cache='none' io='native' discard='unmap'/>
  ...
</disk>

<interface type='network'>
  <source network='default'/>
  <model type='virtio'/>
  <driver name='vhost' queues='4'/>
</interface>

sudo ethtool -L eth0 combined 4

<memballoon model='virtio'>
  <stats period='10'/>
</memballoon>

virsh dommemstat myvm

#!/bin/bash
for d in /sys/kernel/iommu_groups/*/devices/*; do
  n=${d#*/iommu_groups/*}; n=${n%%/*}
  printf 'IOMMU Group %s ' "$n"
  lspci -nns "${d##*/}"
done

lspci -nn | grep -E 'VGA|Audio'
# Example output:
# 01:00.0 VGA compatible controller [0300]: NVIDIA Corporation GP104 [GeForce GTX 1080] [10de:1b80]
# 01:00.1 Audio device [0403]: NVIDIA Corporation GP104 High Definition Audio Controller [10de:10f0]

sudo update-initramfs -u
sudo reboot

lspci -nnk -d 10de:1b80
# Should show "Kernel driver in use: vfio-pci"

<hostdev mode='subsystem' type='pci' managed='yes'>
  <source>
    <address domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
  </source>
</hostdev>
<hostdev mode='subsystem' type='pci' managed='yes'>
  <source>
    <address domain='0x0000' bus='0x01' slot='0x00' function='0x1'/>
  </source>
</hostdev>

wget https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img

# Create a working copy (don't modify the base)
qemu-img create -f qcow2 \
  -b jammy-server-cloudimg-amd64.img \
  -F qcow2 \
  /var/lib/libvirt/images/my-ubuntu.qcow2 \
  20G

#cloud-config
hostname: my-ubuntu
manage_etc_hosts: true

users:
  - name: brian
    groups: sudo
    shell: /bin/bash
    sudo: ['ALL=(ALL) NOPASSWD:ALL']
    ssh_authorized_keys:
      - ssh-ed25519 AAAA... your-public-key

package_update: true
packages:
  - qemu-guest-agent
  - htop

runcmd:
  - systemctl enable --now qemu-guest-agent

instance-id: my-ubuntu-01
local-hostname: my-ubuntu

cloud-localds /var/lib/libvirt/images/my-ubuntu-seed.iso user-data meta-data

virt-install \
  --name my-ubuntu \
  --ram 2048 \
  --vcpus 2 \
  --disk path=/var/lib/libvirt/images/my-ubuntu.qcow2,format=qcow2,bus=virtio \
  --disk path=/var/lib/libvirt/images/my-ubuntu-seed.iso,device=cdrom \
  --os-variant ubuntu22.04 \
  --network network=default,model=virtio \
  --import \
  --noautoconsole

virsh change-media my-ubuntu sda --eject --config

wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install terraform

terraform {
  required_providers {
    libvirt = {
      source  = "dmacvicar/libvirt"
      version = "~> 0.7"
    }
  }
}

provider "libvirt" {
  uri = "qemu:///system"
}

# Base image pool
resource "libvirt_pool" "vms" {
  name = "vms"
  type = "dir"
  path = "/var/lib/libvirt/images/terraform"
}

# Base cloud image volume
resource "libvirt_volume" "ubuntu_base" {
  name   = "ubuntu-22.04-base.qcow2"
  pool   = libvirt_pool.vms.name
  source = "https://cloud-images.ubuntu.com/jammy/current/jammy-server-cloudimg-amd64.img"
  format = "qcow2"
}

# Per-VM disk (thin clone of base)
resource "libvirt_volume" "vm_disk" {
  count          = var.vm_count
  name           = "vm-${count.index}.qcow2"
  pool           = libvirt_pool.vms.name
  base_volume_id = libvirt_volume.ubuntu_base.id
  size           = 21474836480  # 20GB in bytes
}

# cloud-init config
data "template_file" "user_data" {
  count    = var.vm_count
  template = file("${path.module}/user-data.tpl")
  vars = {
    hostname = "vm-${count.index}"
    ssh_key  = var.ssh_public_key
  }
}

resource "libvirt_cloudinit_disk" "init" {
  count     = var.vm_count
  name      = "init-${count.index}.iso"
  pool      = libvirt_pool.vms.name
  user_data = data.template_file.user_data[count.index].rendered
}

resource "libvirt_domain" "vm" {
  count  = var.vm_count
  name   = "vm-${count.index}"
  memory = "2048"
  vcpu   = 2

  cloudinit = libvirt_cloudinit_disk.init[count.index].id

  network_interface {
    network_name   = "default"
    wait_for_lease = true
  }

  disk {
    volume_id = libvirt_volume.vm_disk[count.index].id
    scsi      = true
  }

  cpu {
    mode = "host-passthrough"
  }
}

output "vm_ips" {
  value = [for vm in libvirt_domain.vm : vm.network_interface[0].addresses[0]]
}

variable "vm_count" {
  default = 3
}

variable "ssh_public_key" {
  type = string
}

terraform init
terraform plan
terraform apply -var='ssh_public_key=ssh-ed25519 AAAA...'
terraform destroy

# Debian/Ubuntu
sudo apt install qemu-guest-agent
sudo systemctl enable --now qemu-guest-agent

# RHEL/Rocky
sudo dnf install qemu-guest-agent
sudo systemctl enable --now qemu-guest-agent

<channel type='unix'>
  <target type='virtio' name='org.qemu.guest_agent.0'/>
</channel>

virsh qemu-agent-command myvm '{"execute":"guest-info"}'
virsh domifaddr myvm --source agent    # get IPs via agent
virsh snapshot-create-as myvm snap1 --quiesce  # filesystem-consistent snapshot

# Check VM logs
sudo journalctl -u libvirtd
sudo cat /var/log/libvirt/qemu/myvm.log

# See all active QEMU processes
ps aux | grep qemu

# Check open file handles for a VM
sudo ls -la /proc/$(pgrep -f 'qemu.*myvm')/fd

# Network diagnostics
ip link show type bridge
bridge link show
iptables -t nat -L -n -v   # Check NAT rules for default network

# Storage diagnostics
virsh vol-list default
virsh pool-refresh default
qemu-img check /var/lib/libvirt/images/myvm.qcow2

# Performance: Check if KVM is actually being used
virsh dominfo myvm | grep "CPU time"
# Or check /proc for kvm usage
cat /sys/module/kvm/parameters/enable_vmware_backdoor

sudo systemctl start libvirtd
# Or check group:
groups $USER | grep libvirt

virsh net-start default
virsh net-autostart default

# Check apparmor
sudo aa-status
# Fix ownership
sudo chown libvirt-qemu:kvm /path/to/image.qcow2

virsh dominfo myvm | grep "Emulated machine"
# Confirm KVM acceleration:
virsh capabilities | grep kvm

# Check AppArmor denials
sudo dmesg | grep -i apparmor
sudo aa-status | grep libvirt

# Add a custom path to the libvirt profile
echo '/data/vms/** rwk,' | sudo tee -a /etc/apparmor.d/abstractions/libvirt-qemu
sudo systemctl reload apparmor

# Check SELinux context on disk images
ls -lZ /var/lib/libvirt/images/
# Correct context should be: svirt_image_t

# Restore correct context
sudo restorecon -Rv /var/lib/libvirt/images/

# Drop forwarding from default network to internet (example)
sudo iptables -I FORWARD -i virbr0 -o enp3s0 -j DROP

# Local tunnel example
ssh -L 5900:localhost:5900 user@hypervisor-host
# Then connect VNC to localhost:5900

<graphics type='spice' port='-1' tlsPort='-1' autoport='yes'>
  <listen type='address' address='127.0.0.1'/>
  <image compression='auto_glz'/>
</graphics>

ps aux | grep qemu
# Should show: libvirt-qemu   (not root)

# List all VMs
virsh list --all

# Start / stop
virsh start <vm>
virsh shutdown <vm>
virsh destroy <vm>        # force off

# Get VM IP
virsh domifaddr <vm>
virsh domifaddr <vm> --source agent

# Snapshot
virsh snapshot-create-as <vm> <name> --atomic
virsh snapshot-revert <vm> <name>
virsh snapshot-list <vm>

# Edit config
virsh edit <vm>

# Clone
virt-clone --original <vm> --name <clone> --auto-clone

# Create disk
qemu-img create -f qcow2 /path/to/disk.qcow2 50G

# Inspect disk
qemu-img info disk.qcow2

# Convert disk
qemu-img convert -f qcow2 -O raw src.qcow2 dst.raw

# Network
virsh net-list --all
virsh net-start default
virsh net-dumpxml default

# Storage pools
virsh pool-list --all
virsh pool-refresh default
virsh vol-list default

# Logs
sudo journalctl -u libvirtd -f
sudo tail -f /var/log/libvirt/qemu/<vm>.log